Rewterz Threat Update – Log4Shell Exploited in Cyber Attack Against Belgian Defense Ministry

Severity

High

Analysis Summary

Log4j exploit was used in a cyberattack against the Belgian Defense Ministry. The ministry’s activities were halted for many days following the cyberattack

“Defense on Thursday discovered an attack on its computer network with internet access,” said a military spokesman. 

Apache Log4j is a Java-based logging utility that is widely used in applications around the world. On December 9th, 2021, the working Proof of Concept for the RCE (Remote Code Execution) vulnerability in Apache Log4j 2 was released publicly. Within 2 hours, attackers began the exploitation of the vulnerability and widespread internet scanning began to find vulnerable assets and instances of log4j. 

State-sponsored APT (Advanced Persistent Threat) groups from China, Turkey, North Korea, and Iran have been actively attempting to exploit the vulnerability. The same threat actors exploited the log4j vulnerabilities to carry out this attack against the Belgian Defense Ministry

Impact

• Remote Code Execution
• Ransomware
• Local Code Execution
• Denial of Service

Indicators of Compromise

IP

• 188[.]166[.]57[.]35
• 8[.]36[.]139[.]135
• 81[.]30[.]157[.]43

URL

• http[:]//195[.]54[.]160[.]149[:]12344/Basic/Command/Base64/KGN1cmwgLXMgMTk1LjU0LjE
• http[:]//195[.]54[.]160[.]149[:]12344/Basic/Command/Base64/KGN1cmwgLXMgMTk1LjU0LjE2MC4xND

SHA-1

• 8c2e2f2b493abd6ca90ff0436457d52ea928dd43
• 81f2908cbb43a41fac8208a9805c06521331f512
• 72a3aaf031894dc1736bdfaa25bac181019a9398
• e65b81b050d75b8dcb5374e0b39601abf55d631e

Remediation

CVE-2021-44228 Mitigation:

Permanent Mitigation:

Version 2.16.0 has been released without the vulnerability. Upgrade to Log4j Version 2.16.0.

• https://logging.apache.org/log4j/2.x/index.html
• https://logging.apache.org/log4j/2.x/download.html
• https://logging.apache.org/log4j/2.x/security.html

Temporary Mitigation:

If upgrading to version 2.16.0 is not possible at the moment, then the following workarounds can be done for mitigating the vulnerability:

As the lookups are done using the Java packages for JNDI API (com.sun.JNDI.ldap.object.trustURLCodebase) or by (InitialContext().lookup(“lookup address”)) by creating an instance using (org.apache.naming.factory.BeanFactory), we have to disable the lookups functionality for the remote serves to mitigate the vulnerability.

1. For Log4j version >= 2.10, the vulnerability can be mitigated by setting either the system property “log4j2.formatMsgNoLookups” or environmental variable “LOG4J_FORMAT_MSG_NO_LOOKUPS” to “true” by adding -Dlog4j2.formatMsgNoLookups=True when starting the Java Virtual Machine.
2. For Log4j version between 2.0 to 2.10 the vulnerability can be mitigated by removing the “Jndilookup” class from the class-path “zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class”

CVE-2021-45046 Mitigation:

Permanent Mitigation:

Version 2.16.0 has been released without the vulnerability. Upgrade to Log4j Version 2.16.0.

• https://logging.apache.org/log4j/2.x/download.html
• https://logging.apache.org/log4j/2.x/security.html

Temporary Mitigation:

If upgrading to version 2.16.0 is not possible at the moment, then the following workarounds can be done for mitigating the vulnerability.

1. Disable message lookup patterns in Log4J.
2. Remove the JNDI class and disable all the lookup services.

CVE-2021-45105 Mitigation:

Upgrade to the latest version of Apache Log4j, available from the Apache Web site. 

• https://logging.apache.org/log4j/2.x/security.html

CVE-2021-4104 Mitigation:

Upgrade to the latest version of Log4j, available from the Apache Web site.

• https://logging.apache.org/log4j/1.2/

Here’s a repository containing all the affected and unaffected vendors and software that are affected by the log4j vulnerability along with their patches. 

• https://github.com/NCSC-NL/log4shell/tree/main/software

Against the WebSockets Attack Vector:

Like the Log4j exploits, the WebSocket attack vector is resilient and silent and therefore detection is fairly difficult. However, here are a few methods to detect and remediate the attacks in your environment:

1. The researchers that released the attack recommend looking for “.*/java.exe” instances being as a parent process for “cmd.exe/powershell.exe.”
2. The publicly available scanning scripts that help detect Log4j in local environments are:
   • Windows PoSh – https://github.com/N-able/ScriptsAndAutomationPolicies/blob/master/Vulnerability%20-%20CVE-2021-44228%20(Log4j)/get-log4jrcevulnerability.ps1
   • Cross-platform – https://github.com/hillu/local-log4j-vuln-scanner/releases